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ABSTRACT 


A complex system envisioned can accomplish a given 
mission with the aid of any one of several alternative 
structures. Each of these alternative structures (subsys- 
tems), although capable of mission accomplishment, exhibits 
different levels of performance due to its component inven- 
tory. The structures are ordered in preference accordingly. 
Operation on less-preferred structures is a function of 
component/structure failure histories in prior structures. 
Failures are classified by three levels of severity. A 
system effectiveness model is developed to provide a measure 
of effectiveness for the overall complex system which encom- 


passes all possible alternative structures. 
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CEALP TE ak 


INTRODUCTION 


In light of the present day advancing technology, sys- 
tems have become vastly complex. Coupled with this rise in 
complexity has been a gradual increase in component and 
system size, weight and/or cost. The rise in complexity in 
just avionics systems over the 12-year period between 1953 
and 1965 has been by a factor of 74, not to mention the ex- 
pected complexity factor of 160 times the 1953 avionic sys- 
tem for the year 1968. [1] None-the-less these new complex 
systems cannot always incorporate redundant components or 
subsystems due to size, weight, and/or cost constraints; 
this is particularly true for an aircraft. However, there 
may exist a less-sophisticated component or group of com- 
ponents that can perform the same (or similar) function as 
a complex component, but somehow in a less effective manne, 
e.g., solution time longer, greater uncertainty in solution, 
or lower probability of success. This less effective group 
of components, "alternative structure", can also accomplish 
the mission and thereby improves the overall system effec- 
tiveness by a new form of redundancy, since the usual form 
of redundancy implies equal effectiveness. 

The foregoing concerning complex systems and associ- 
ated constraints applies most assuredly to military weapons 
systems being contemplated for aircraft, ship and submarine 


pilawirerms of ume Wuture. 


I. PURPOSE OF THE SYSTEMS EFFECTIVENESS MODEL 


In spite of the enormous complexities and the size, 
weight and/or cost constraints, a weapons system must 
still achieve a high mission reliability, usually in the 
high nineties, where mission reliability is defined to be 
"the probability of adequate system performance for the du- 
ration of the mission in the usual mission environment." 

In this paper adequate system performance will imply that 
at least one alternative structure, i.e€., a subsystem ca- 
pable of mission accomplishment, remains operable. An 
operable structure by definition experiences only repair- 
able type (minor) failures during a mission. 

The problem is to develop a model to measure the over- 
all system effectiveness which incorporates the effects of 
availability,conditioned effectiveness and the component/ 
structure failure degradation over all admissible alterna- 
tive structures. The measure of system effectiveness 
derived, hopefully, will approximate the "systems perform- 
ance effectiveness" defined as “a measure of the extent to 
which a system can be expected to complete its assigned 
mission within the time frame under the stated environment- 


al conditions." [2] 


II. SIGNIFICANCE OF THE MATHEMATICAL MODEL 
The United States Navy currently has under development 
several new complex weapons systems to cope with the growing 


submarine threat. The P3C patrol aircraft, being developed 
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by Lockheed at Burbank, California, and under evaluation by 
the ASW Projects Office, Washington, D.C., is one such weap- 
ons system. The revolutionary weapons system incorporates 

a variety of sophisticated detection sensors in a complex 
computerized system design. For each of the several mis- 
Sions of the P3C aircraft, there exists a set of alternative 
structures of components feasible to the accomplishment of 
that mission. The ultimate purpose of this effectiveness 
model is to obtain a quantitative measure to be used in de- 
sign alteration comparisons in the P3C aircraft. 

The alternative structured approach for the P3C air- 
craft seems practicable for the following reasons: (1) by 
the nature of the aircraft/submarine detection and tracking 
problem, the structure most effective for a mission may 
change during a mission engagement as a result of environ- 
mental or target tactics, and (2) by reason of limited 
weight and space requirements aboard an aircraft, a failure 
may occur to cause an operating structure to be inoperative 
(nmon-repairable) for the remainder of the mission. Either 
of these reasons necessitates operation on another alterna- 
tive structure, usually of different performance and/or re- 
jPabsyop lane a 

The mathematical model developed by Zagor, et al., [3] 
for computing the reliability of a hypothetical multi-model 
fire control system treated a similar system redundancy 
variation. In the Zagor model the system effectiveness of 


a three mode hypothetical fire control system was formulated 
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accounting for mode effectiveness and mode likelihood. The | 


system effectiveness model to be described in Chapter II 

and derived mathematically in Chapter III takes into con- 
Sideration three levels of failure severity: failures 
unacceptable to mission accomplishment, failures permissi- 


ble but non-repairable, and failures permissible and repair- 





able. 


ie 





CHAPTER II 


DESCRIPTION AND FORMULATION OF MODEL 

A particular mission of a complex system can be accom- 
plished by any one of several alternative structures (sub- 
systems) of the system components. The alternative struc- 
tures are composed of components in logical series and are 
ordered in preference by their attainable degree of mission 
performance. Component failures in this complex system are 
grouped into three classes of severity, namely critical, 
major and minor failures. Component failures that are not 
allowable in the accomplishment of the mission, and as such 
cause mission abort when they occur, are defined as critical 
failures. A major failure is one whose occurrence precludes 
any further operation with the associated structure during 
mission, i.e., forces a shift to a lower priority structure, 
and may result in degrading the effectiveness of an alterna- 
tive structure. Component failures repairable during a mis- 
sion by on-board repair parts are defined as minor failures. 
Minor failures degrade structure/system effectiveness (per- 
haps proportional to structure down-time or function lost) 
DUEMdG=not require a shirt to anoOticr  =aeromnce ve cemiies 
ture. This model establishes a functional relationship to 
quantify the overall system effectiveness taking into con- 
Sideration the various performance levels and reliabilities 


of all mission-orientated alternative structures. 


ie 


The primary or priority one alternative structure is 
that structure capable of obtaining the greatest degree of 
mission performance due to its sophisticated component de- 


Sign. The priority one structure, §S may in a particular 


} 
system include all components of the system. However, this 
is usually not the case since most complex systems incorpo- 


rate redundant components (components that will perform the 


same function) having a lower performance capability. The 





performance of the priority one structure ina failure-free i 
environment is primarily a function of three variables, 
namely: (1) the state of the art in component/system engi- 
neering design, (2) the environmental operating factors en- 
countered during a mission, and (3) the component operator's 
state of training and performance levels. However, there 
exists some average level of effectiveness, ET , realized 
when operating the system utilizing the primary structure 
Si in a failure-free environment. But when failures occur, 
structure/system effectiveness becomes degraded. 

For a particular mission a complex system has the set 
of admissible alternative structures is. |] = 1, 27 a 
ordered in preference. Each alternative structure =, has 
associated with it the sets of components susceptable to 
critical, major and minor failures, i.e., ae He and ue 


respectively, where 


Fi 1CuuC.,, ec. ——etiNes } 
i a 2 sie) IG. 


Me = AM, Mas) >> 2 “yt Ml eee 
J ape Ie Jk JK. 
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H, = {m. re ae eal } 
J gil j2 mee iL. 


J 
and Ss eB wee represent the events Of critical, Majer 
and minor failures in structure Sa respectively. Similar- 
ligne, Mae ae =, and ee take tay correspond to the 


component failure rates and operating durations for the 
components in Fae Ui and Ke respectively. The effective- 
ness of a system experiencing a critical (abort type) fail- 
ure will be by definition equal zero. The major failures 
are those failures which are non-repairable during the mis- 
sion and which force system operation into an alternative 
structure of less desirable performance, This less effect- 
ive structure is also susceptible to degradation from the 
major failure(s) in prior structure(s). Let the degrada- 


tiene ractor, be defined as the degradation factor 


O5k, 541" 
resulting from event Mak 


Minor failures also connote a degrading effect, but the de- 


on structure S. 


441 in structure S4- 


gradation factor iS applied to present structure effective- 
ness. Now lye denotes the degradation factor on struc- 
ture S. due to the event ee aia Soe Several assumptions are 
now made about the component failure distributions. 
Independent exponential failure time distributions are 
assumed on all components and on all subassemblies whose 
failure is a critical, major, or minor event. The failure 
rate, A, of a component is the same regardless of the alter- 


native structure in which it is operating. The failure 


rates of components in non-operating states are equal to 


lige 


zero. If a particular component in the system is suscept- 
ible to more than one class of failure, then that component 
will be subdivided into pseudo components affected by only 
one class of failure for ease of formulation of the model. 
The effect of failures on mission performance will now be 
considered. 

From the preceding discussion of failure types and con- 
Sidering a particular system design, one can enumerate the 
success paths (system failure histories) such that the mis- 
sion will still be accomplished, but degraded in varying 
amounts by the effects of associated failures. To obtain a 
quantified measure of effectiveness that incorporates the 
flexibility in performance and reliability in an alterna- 
tive structured system, the system effectiveness model is 
formulated below encompassing all possible success paths in 


the accomplishment of the mission. 


ime) 


CArpiT Era it 


SYSTEM EFFECTIVENESS MODEL DERIVATION 
Mission accomplishment is associated with the greatest 
system effectiveness when no critical or major failures 
eccur during the mission du*vation (0,1). In this particwlar 
"success path", i.e., no failure in the primary structure 
Sie the overall system effectiveness is the product of E 


1 


(the average effectiveness of structure S, accounting for 


Ik 
minor failure degradation effects) times the probability of 
no critical or major failures. Let RC. (t) and RM. (t) be 
respectively the probability of no critical and of no major 
failures in structure es during timem(e,;t).~” Ben, 1£ emily 


one structure existed for a particular system, the system 


effectiveness would be 


E= E, x RC, (T) Xx RM, (T). 


However, in the complex system envisioned here, there are 
several alternative structures feasible to the accomplish- 
ment of mission, and the alternative structures are utiliz- 
ed when preferred structures fail. As such, system effec- 
tiveness must account for this incremental effectiveness 
obtained via alternative structures when these same struc- 
tures are probable. 

The formulation of such a model accounting for the 
effectiveness of all alternative structures weighted by 


each structure's probability of being utilized follows: 


7 


System Effectiveness on Mission m (EF) is modeled 


as 
5 
E., = E} x RC, (T) x RM, (T) + ), B ae (1) 
j=2 
where 
RC, (T) = Probability of no critical failures in Sy 
during mission 
G] 
= exp i > ae ee 
\e 
RM, (T) = Probability of no major failures in Sy during 
mission 
\ 
Ki \ 
= exp - ) dak tay 
k=1 / 
ae = Average structure 2a effectiveness accounting 
for degradation from major failures in prior 
structures and degradation from minor failures 
ineS . 
J 
and 
P. = Probability structure Sy Soo coes oe each 


experience a major and no critical failure, 
and S441 experiences no major or critical 
failures in lone 


t Accounts for all (J) admissible alternative structure 


effectiveness given the structure is reliable. 


£ During mission hereafter denoted by (0,T). 


Ere: 








Now E. is obtained in the following manner. First of 
all, it is assumed that the effectiveness of performance 
level of any particular alternative structure given no fail- 
ures, defined as ES, is known or may be estimated by opera- 
tional exercises. The E. represents the nominal structure 
2 effectiveness for the current state of the art, the en- 
vironmental operating factors encountered, and the opera- 
tor performance level as discussed previously. But E* must 
account for (i.e., be degraded by, when appropriate) the 


effect of major failures in prior structures § SoreeerS 


id 


on structure Sa ° Letting Di. : be the degradation factor 
eo 


j-L1 


in strug@twuce Si, fi@ae 


on = from the first major failure Mix 


i = 3, Le tolbews thate 


jr Ni 
E = E* ) yy Dig, 5 ( Probability first major fascias) 
J J Pee ea TT S. is M. ik 
j-l1 Ki 
Si ) Bea. IOS 5 a | 
i=l k=1 age 
where Ey is identically E) , and 


ts = Average effectiveness of Ss accounting £Or ma jou 


failures in structures Sie Sos eesete Seas 


t When a major failure has no degradation effect ona 


structure, then the degradation factor is zero. 


te 


where the term in parentheses above is derived in Appendix A. 
A particular alternative structure a effectiveness 
should also take into consideration the several success 
paths under various minor failure histories within that 
structure. Therefore a weighted average of the E.'’ , defin- 
ed above, where the weights are the products of the various 
probabilities of minor failure(s) and the associated minor 
failure(s) degradation seems plausible for an average struc- 
ture effectiveness He capability. Formulating the above we 
obtain, assuming independent exponential distributions, the 


following: 


Es = ; (Grobability no minor failures in S5 in (0,T).) 


5, Prob. m. ise) Prob. no other 
—e 


— in S. f (Oma) minor failures in 
Lt=1 7 
(0,T) 


2 J uc YG. 4". ~ SEI lite Prob. no 


es ee Sik and “ie other minor 
ham Py ae in failures in 
F ig A2k in (O72 


+ € (small order’ terms) 


Inserting the probabilistic results derived in Appendix B, 


it follows that 


+ A more .conservative approximation would be obtained by 
replacing a) in the first term by T; also simplifying 


calculations. 
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ie 

j 
7 ), Mea 
f= 1 | 


- = a e 
Tis 
L- J 
x Pp AST 
“3 4" sav ret 
i (a | 5) ,-e%'= . 
j LS 32 “J 
L . L 
“ o Sy i 
Dd; eet PY SY ees 
oe } ra : Je, ie l-e fi=l se ee e LA a 
oe i, 
=) g%= 
ar 
+ € (small order terms) | “me 


Simplaficatren to. the cateulation Ge “ene B terms, 
1h; . 


when the Biss exponent terms are small, would be to use 
approximation ) ly 2 
Ba As L L AT 
| J] 
l-e we \ a gi ae 5 si 
£=l1 


discarding the higher order terms when input data shows 
them to be insignificant. 


P., the probability that structures S., S$ S 


; 1? es, 5 


each experience a major and no critical failure, and struc- 


ture © am experiences no major or critical failures in(0,T) 


1s obtained as follows. Ne be the minimum {o4,7 gigneses 


tye where T. is the time to event M (major failure 


J Uae acme: j'k 


Zh 


event in -_ then va represents the time to first major 


failure in S. - Now define 


dey 


LJ. 


as the “time for a sequence of major failures in structures 
Si. Sos ee Sat with the assumption of zero switching 

time between alternative structures. Let - (t) be the pro- 
bability density function of the time for a a tae On 


major failures in structures §S S 


iif oe eoo 0 226 Thus 


En = Prob. SHO oh fail major, 


Gp Sap e eek SeenoOe fan Loerarmri cad ¢ 
| eae 5 


TET not fail major for remainder of mission, 

S444 not fail critical for remainder of mission 
and 
P= i "e (t) Cl] RC. mole a1 (Tot) | | RCS, (P-t)| ae 

(5) 
where 
(X.) IIH “i. t 

i ey + 1 e j= 2 ee J-1 
u GD 


ID: 


is agammaP.D.F. [4] , where equal structure r. (mean time to 


first major failure is assumed) is 


ee 
_ = 
J = Ay 3 where d. = Lp 
Me Sn ae N)/5 
J 
Assuming nat TT] RC. ce) en p(T); chen bas 45) 
i) ul J 
becomes 
K. G. 
, J 
: : : -—t - . -t 
5 f aoe 94, : Dj a 
~ | 2 oS 
P.= RC week 
eee hi T(5) i 


(6) 


Examining Eq. (6) for a few small j values, we obtain 


Ko 
Dig a 2B ay (Tt) 3 Digg (THE) 
P_=e ) Ay e ae e g=1 ehe 


=1 g=1 k=1 


_ dt 


K,, G. 
: Satie hag Shas ( “Py Dox > ) 2g ; 
de k=] g=1 


O 
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= 1 at 
O 
where 
Gy > ne 
_ + 
D, = ) gig 1 ie PRAT 
g=1 g=1 iea— Al: | 
, 
| 
a 2 
a i oe ) rox i /) A Gres 
k=1 g=1 


Then it follows that 


K3 G 
T —- = 
ft) eee aren) J Agg (Tot) 
“DZ }POAg) © -AgtE | pay =} 
Pee ——>-—— € eel 2 29 dt 
2 o} T(2) 
*3 oe 
JL 
=D -fA, - )r yy t 
7 2 = oe 2 3k 3 
=e | te k=1 eat dt 
O 
-D. _ - 9 -Fot 
=e | (A.) te elie 
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— Oo ——— 


where 


am 


o) 2 
2 ea i Lo - ) ae 
g=1 i=l g=1 


gel 


Se 3 
BS. D., + ), AgoP + ) rae 
g=l1 k=l 
R3 iets 
a er - se 
k=1 g=l 


Similarly we obtain P, 


T = (3 .2 
— = f (A3) t ae 
3 (3s) 


Each of the integral expressions in P 


= GLE 


P, and P. may be 


le 2 3 


transformed into incomplete gamma functions (Py degenerates 


into an exponential function) 


pe pe -F_t = 
p. aeen | Ae A oe 
O 


AB 
-D, { a> -FSt 
e 
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as follows 


Tv — 
dy Fit 
—— Fie ale 
F 1 
i. oO 








The latter is obtained by the substitution, s = F,t. 
The Incomplete Gamma Function is evaluated from Incom- 
plete Gamma tables or readily from Poisson tables, after 


using the following well known identity (See Appendix c) .[5] 


os) 


AL 
a ee = ce 
| (XE) fea = y Ca 


(3) (ae! 
1=j 
For example 
3. @ a 
7 ~D2 ds ™ (FT) —PAT 
P, =e = = 


W 
Hy 
Le) 
aa 
0 = 


Now that all terms of equation (1) have been formula- 
ted, each may be evaluated with proper input and inserted 
in Eq.(1) to give a quantitative measure of overall system 


effectiveness. 
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CHAPTER IV 
SUMMARY AND CONCLUSIONS 


I. SUMMARY 

"The effective performance of Navy systems in fleet 
use iS essential to successful Navy operations." [1] The 
alternative structure concept of a complex weapons system 
seems to have merit in the improvement of "system perfor- 
Matec erMrectavences. | We Taese se oirerart cemeaine alcome lox 
system that is recognized to have such a structure due to 
the nature of itsS misSion. 

in the preceding chapters a complex mission ocrieneed 
system composed of a set of ordered alternative structures 
(any one of which are capable of mission accomplishment) 
was described. The preference ordering of structures was 
assumed to be by performance. Failures of components of a 
structure were classified into one of three levels of 
severity: critical, major or minor failure. The effects 
of failures on system effectiveness were accounted for by 
degradation factors, such that a critical failure caused 
total degradation or mission abort, a major failure comple- 
tely degraded the current structure, and a minor failure 
(repairable) partially degraded the current structure. 

A mathematical model for the above system design was 
then developed to obtain a quantitative measure of the over- 
all system effectiveness reflecting the capability or multi- 


ple success paths admissible in the accomplishment of a 


particular mission. 
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II. CONCLUSIONS 

Several assumptions and approximations (presumably 
conservative) were made in obtaining a closed form solution. 
In any application of the model the assumptions and limita- 
tions must be considered. First of all, the model applies 
to a specific kind of system design. The measure of effec- 
tiveness obtained from the model can only be as good as the 
input data; consequently, failure rates, performance and 
degradation factors, etc., should be revised to reflect 
current knowledge. If independent exponential failures 
cannot be assumed, then the model must be modified or used 
with discretion. When the assumption can be accepted, this 
model affords a straight-forward solution with the proper 


input paramters. 


TIT. ADDITIONAL RESEARCH 

Further research effort is needed to test the model 
(for example by simulation techniques) for its sensitivity, 
with current P3C design parameters. While this model treats 
a major failure as a trigger to cause a shift in alterimae 
tive structure, the model could be altered to address the 
problem of a structure shift due to a target tactical ma- 
neuver. This preliminary model when validated could by 
Simulations provide insight into the effects of changing on= 


board repair parts and altering a component structure fail- 
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f 
) 
; 


ure severity by incorporation of redundant components. [In 
this way, design revision results in terms of "system per- 
formance effectiveness" could be quantified for decision 


purposes. 


Ze 


lie 


2s 


3a 


4. 
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APPENDIX A 


\ \ 
kL. Derivation of Probability First major failure 


1n Ss; 1s Mey 


Let Tay = the random variable time to major fail- 
UGE My° 


Weng (GED Wha) 


V = Min Tt 
1<k' <K, 


(ook) 


ik' 


then 


P(T.,>t)P(T. >t) ---P(TiKx.>t) 
1 - F(t) = prob. (v>t) = es 2 ee 


> 
P(T sy t) 
/ K. 
1 
= exp, - eSene 
ke 
(k'#k) 
and K. 
ah 
fee = ey t where = =x 
V Me! Me! ik! 
k'=1 
k'#k 
Now 
Prob. | First major failure = Prob. (Gr. < v) 


1n S5 1s Mey 


5) II 
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APPENDIX B 


l. Derivation of Probability No minor failures 


1b gt oe in (OeT) 


Let So = the random variable time minor failure 


r 


sg! Pay) = failure rate and operation duration of 


the component £ in structure S. 


Prob. | No minor failures 


she g S. in e0,T) 


Prob. (x, =t..: fom all 1 s 27s Ey) 
Jf V4 J 


exp ~ eer 
L=1 


2. Derivation of Prob. occurs \ Prob.| No other minor 


Ts gt 
in S. failures in 


Pie 5 } S. in (©, 2) 


prob:(X, 4, < T) Prob. (min Ma Pt) 


Nee 
- As pT 


G1 - Pe Fs e 4y 


3. Derivation of Prob. Ms gas hay Prob. / No other minor 
Geeur an failures in 
S. at (0,4) S. in (07a) 


so 


follows similarly and as given by 


-G-6 38") (epee) . 
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APPENDIX C 


lh j-1 = os i 
i, Show | _—— 2 At dt = ) “— Se 
O Cease! ‘ 


i=} 
where i is the mean rate of occurrence of failures. 


Probability that the time to occurrence 


Let F. (T) 
: h 

of the 4° major failure event will be 

less than T( represented by the term on 


left of the identity above). 


then, l - F(T) Probability that the time to occurrence 
of the qige major failure event will be 


greater than T. 


and equivalently 


1 - F(T) Probability that the number of major 
failure events in the time 0 to T is 


less than j. 





Since the major failure events are happening in accordance 
with a Poisson probability law with an assumed mean rate A, 


it follows that 


ab 


1 i - 
i < F (T) a Ce 


a iat 
or F(T) y a (AT) e 
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fk | 
je = = * . 
Therefore |e e At Co —— ) 1 ary Piet 
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